Eric Lee / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 5600b892789c21749898e1ef815a2b9b152f51e0

Authored by Daniel Walker
Committed by Linus Torvalds
1 parent bd3a8492ba
Exists in master and in 39 other branches 8mp-imx_5.4.70_2.3.0, 8qm-imx_5.4.70_2.3.0, emb_imx_lf-5.15.y, emb_lf-6.1.y, imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, imx_4.1.15_1.0.0_ga, pitx_8mp_lf-5.10.y, rt-smarc-imx_4.1.15_1.0.0_ga, rt_linux_5.15.71, smarc-8m-android-11.0.0_2.0.0, smarc-imx6_4.14.98_2.0.0_ga, smarc-imx6_4.9.88_2.0.0_ga, smarc-imx7_4.14.98_2.0.0_ga, smarc-imx7_4.9.11_1.0.0_ga, smarc-imx7_4.9.88_2.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-imx_4.1.15_1.0.0_ga, smarc-imx_4.9.11_1.0.0_ga, smarc-imx_4.9.51_imx8m_ga, smarc-imx_4.9.88_2.0.0_ga, smarc-m6.0.1_2.1.0-ga, smarc-n7.1.2_2.0.0-ga, smarc-rel_imx_4.1.15_1.2.0_ga, smarc_8m_00d0_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.14.78_1.0.0_ga, smarc_8m_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.19.35_1.1.0, smarc_8mm_imx_4.14.78_1.0.0_ga, smarc_8mm_imx_4.14.98_2.0.0_ga, smarc_8mm_imx_4.19.35_1.1.0, smarc_8mm_imx_5.4.24_2.1.0, smarc_8mp_lf-5.10.y, smarc_8mq_imx_5.4.24_2.1.0, smarc_8mq_lf-5.10.y, smarc_imx_lf-5.15.y

whitespace fixes: system auditing 

Just removing white space at the end of lines.

Signed-off-by: Daniel Walker <dwalker@mvista.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 7 additions and 7 deletions Inline Diff

1 /* audit.c -- Auditing support 1 /* audit.c -- Auditing support
2 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon. 2 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon.
3 * System-call specific features have moved to auditsc.c 3 * System-call specific features have moved to auditsc.c
4 * 4 *
5 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina. 5 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina.
6 * All Rights Reserved. 6 * All Rights Reserved.
7 * 7 *
8 * This program is free software; you can redistribute it and/or modify 8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by 9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or 10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version. 11 * (at your option) any later version.
12 * 12 *
13 * This program is distributed in the hope that it will be useful, 13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details. 16 * GNU General Public License for more details.
17 * 17 *
18 * You should have received a copy of the GNU General Public License 18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software 19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 * 21 *
22 * Written by Rickard E. (Rik) Faith <faith@redhat.com> 22 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
23 * 23 *
24 * Goals: 1) Integrate fully with SELinux. 24 * Goals: 1) Integrate fully with SELinux.
25 * 2) Minimal run-time overhead: 25 * 2) Minimal run-time overhead:
26 * a) Minimal when syscall auditing is disabled (audit_enable=0). 26 * a) Minimal when syscall auditing is disabled (audit_enable=0).
27 * b) Small when syscall auditing is enabled and no audit record 27 * b) Small when syscall auditing is enabled and no audit record
28 * is generated (defer as much work as possible to record 28 * is generated (defer as much work as possible to record
29 * generation time): 29 * generation time):
30 * i) context is allocated, 30 * i) context is allocated,
31 * ii) names from getname are stored without a copy, and 31 * ii) names from getname are stored without a copy, and
32 * iii) inode information stored from path_lookup. 32 * iii) inode information stored from path_lookup.
33 * 3) Ability to disable syscall auditing at boot time (audit=0). 33 * 3) Ability to disable syscall auditing at boot time (audit=0).
34 * 4) Usable by other parts of the kernel (if audit_log* is called, 34 * 4) Usable by other parts of the kernel (if audit_log* is called,
35 * then a syscall record will be generated automatically for the 35 * then a syscall record will be generated automatically for the
36 * current syscall). 36 * current syscall).
37 * 5) Netlink interface to user-space. 37 * 5) Netlink interface to user-space.
38 * 6) Support low-overhead kernel-based filtering to minimize the 38 * 6) Support low-overhead kernel-based filtering to minimize the
39 * information that must be passed to user-space. 39 * information that must be passed to user-space.
40 * 40 *
41 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/ 41 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/
42 */ 42 */
43 43
44 #include <linux/init.h> 44 #include <linux/init.h>
45 #include <asm/types.h> 45 #include <asm/types.h>
46 #include <asm/atomic.h> 46 #include <asm/atomic.h>
47 #include <linux/mm.h> 47 #include <linux/mm.h>
48 #include <linux/module.h> 48 #include <linux/module.h>
49 #include <linux/err.h> 49 #include <linux/err.h>
50 #include <linux/kthread.h> 50 #include <linux/kthread.h>
51 51
52 #include <linux/audit.h> 52 #include <linux/audit.h>
53 53
54 #include <net/sock.h> 54 #include <net/sock.h>
55 #include <net/netlink.h> 55 #include <net/netlink.h>
56 #include <linux/skbuff.h> 56 #include <linux/skbuff.h>
57 #include <linux/netlink.h> 57 #include <linux/netlink.h>
58 #include <linux/selinux.h> 58 #include <linux/selinux.h>
59 #include <linux/inotify.h> 59 #include <linux/inotify.h>
60 #include <linux/freezer.h> 60 #include <linux/freezer.h>
61 #include <linux/tty.h> 61 #include <linux/tty.h>
62 62
63 #include "audit.h" 63 #include "audit.h"
64 64
65 /* No auditing will take place until audit_initialized != 0. 65 /* No auditing will take place until audit_initialized != 0.
66 * (Initialization happens after skb_init is called.) */ 66 * (Initialization happens after skb_init is called.) */
67 static int audit_initialized; 67 static int audit_initialized;
68 68
69 /* 0 - no auditing 69 /* 0 - no auditing
70 * 1 - auditing enabled 70 * 1 - auditing enabled
71 * 2 - auditing enabled and configuration is locked/unchangeable. */ 71 * 2 - auditing enabled and configuration is locked/unchangeable. */
72 int audit_enabled; 72 int audit_enabled;
73 73
74 /* Default state when kernel boots without any parameters. */ 74 /* Default state when kernel boots without any parameters. */
75 static int audit_default; 75 static int audit_default;
76 76
77 /* If auditing cannot proceed, audit_failure selects what happens. */ 77 /* If auditing cannot proceed, audit_failure selects what happens. */
78 static int audit_failure = AUDIT_FAIL_PRINTK; 78 static int audit_failure = AUDIT_FAIL_PRINTK;
79 79
80 /* If audit records are to be written to the netlink socket, audit_pid 80 /* If audit records are to be written to the netlink socket, audit_pid
81 * contains the (non-zero) pid. */ 81 * contains the (non-zero) pid. */
82 int audit_pid; 82 int audit_pid;
83 83
84 /* If audit_rate_limit is non-zero, limit the rate of sending audit records 84 /* If audit_rate_limit is non-zero, limit the rate of sending audit records
85 * to that number per second. This prevents DoS attacks, but results in 85 * to that number per second. This prevents DoS attacks, but results in
86 * audit records being dropped. */ 86 * audit records being dropped. */
87 static int audit_rate_limit; 87 static int audit_rate_limit;
88 88
89 /* Number of outstanding audit_buffers allowed. */ 89 /* Number of outstanding audit_buffers allowed. */
90 static int audit_backlog_limit = 64; 90 static int audit_backlog_limit = 64;
91 static int audit_backlog_wait_time = 60 * HZ; 91 static int audit_backlog_wait_time = 60 * HZ;
92 static int audit_backlog_wait_overflow = 0; 92 static int audit_backlog_wait_overflow = 0;
93 93
94 /* The identity of the user shutting down the audit system. */ 94 /* The identity of the user shutting down the audit system. */
95 uid_t audit_sig_uid = -1; 95 uid_t audit_sig_uid = -1;
96 pid_t audit_sig_pid = -1; 96 pid_t audit_sig_pid = -1;
97 u32 audit_sig_sid = 0; 97 u32 audit_sig_sid = 0;
98 98
99 /* Records can be lost in several ways: 99 /* Records can be lost in several ways:
100 0) [suppressed in audit_alloc] 100 0) [suppressed in audit_alloc]
101 1) out of memory in audit_log_start [kmalloc of struct audit_buffer] 101 1) out of memory in audit_log_start [kmalloc of struct audit_buffer]
102 2) out of memory in audit_log_move [alloc_skb] 102 2) out of memory in audit_log_move [alloc_skb]
103 3) suppressed due to audit_rate_limit 103 3) suppressed due to audit_rate_limit
104 4) suppressed due to audit_backlog_limit 104 4) suppressed due to audit_backlog_limit
105 */ 105 */
106 static atomic_t audit_lost = ATOMIC_INIT(0); 106 static atomic_t audit_lost = ATOMIC_INIT(0);
107 107
108 /* The netlink socket. */ 108 /* The netlink socket. */
109 static struct sock *audit_sock; 109 static struct sock *audit_sock;
110 110
111 /* Inotify handle. */ 111 /* Inotify handle. */
112 struct inotify_handle *audit_ih; 112 struct inotify_handle *audit_ih;
113 113
114 /* Hash for inode-based rules */ 114 /* Hash for inode-based rules */
115 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; 115 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
116 116
117 /* The audit_freelist is a list of pre-allocated audit buffers (if more 117 /* The audit_freelist is a list of pre-allocated audit buffers (if more
118 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of 118 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of
119 * being placed on the freelist). */ 119 * being placed on the freelist). */
120 static DEFINE_SPINLOCK(audit_freelist_lock); 120 static DEFINE_SPINLOCK(audit_freelist_lock);
121 static int audit_freelist_count; 121 static int audit_freelist_count;
122 static LIST_HEAD(audit_freelist); 122 static LIST_HEAD(audit_freelist);
123 123
124 static struct sk_buff_head audit_skb_queue; 124 static struct sk_buff_head audit_skb_queue;
125 static struct task_struct *kauditd_task; 125 static struct task_struct *kauditd_task;
126 static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait); 126 static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
127 static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait); 127 static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
128 128
129 /* Serialize requests from userspace. */ 129 /* Serialize requests from userspace. */
130 static DEFINE_MUTEX(audit_cmd_mutex); 130 static DEFINE_MUTEX(audit_cmd_mutex);
131 131
132 /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting 132 /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
133 * audit records. Since printk uses a 1024 byte buffer, this buffer 133 * audit records. Since printk uses a 1024 byte buffer, this buffer
134 * should be at least that large. */ 134 * should be at least that large. */
135 #define AUDIT_BUFSIZ 1024 135 #define AUDIT_BUFSIZ 1024
136 136
137 /* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the 137 /* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the
138 * audit_freelist. Doing so eliminates many kmalloc/kfree calls. */ 138 * audit_freelist. Doing so eliminates many kmalloc/kfree calls. */
139 #define AUDIT_MAXFREE (2*NR_CPUS) 139 #define AUDIT_MAXFREE (2*NR_CPUS)
140 140
141 /* The audit_buffer is used when formatting an audit record. The caller 141 /* The audit_buffer is used when formatting an audit record. The caller
142 * locks briefly to get the record off the freelist or to allocate the 142 * locks briefly to get the record off the freelist or to allocate the
143 * buffer, and locks briefly to send the buffer to the netlink layer or 143 * buffer, and locks briefly to send the buffer to the netlink layer or
144 * to place it on a transmit queue. Multiple audit_buffers can be in 144 * to place it on a transmit queue. Multiple audit_buffers can be in
145 * use simultaneously. */ 145 * use simultaneously. */
146 struct audit_buffer { 146 struct audit_buffer {
147 struct list_head list; 147 struct list_head list;
148 struct sk_buff *skb; /* formatted skb ready to send */ 148 struct sk_buff *skb; /* formatted skb ready to send */
149 struct audit_context *ctx; /* NULL or associated context */ 149 struct audit_context *ctx; /* NULL or associated context */
150 gfp_t gfp_mask; 150 gfp_t gfp_mask;
151 }; 151 };
152 152
153 static void audit_set_pid(struct audit_buffer *ab, pid_t pid) 153 static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
154 { 154 {
155 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb); 155 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
156 nlh->nlmsg_pid = pid; 156 nlh->nlmsg_pid = pid;
157 } 157 }
158 158
159 void audit_panic(const char *message) 159 void audit_panic(const char *message)
160 { 160 {
161 switch (audit_failure) 161 switch (audit_failure)
162 { 162 {
163 case AUDIT_FAIL_SILENT: 163 case AUDIT_FAIL_SILENT:
164 break; 164 break;
165 case AUDIT_FAIL_PRINTK: 165 case AUDIT_FAIL_PRINTK:
166 printk(KERN_ERR "audit: %s\n", message); 166 printk(KERN_ERR "audit: %s\n", message);
167 break; 167 break;
168 case AUDIT_FAIL_PANIC: 168 case AUDIT_FAIL_PANIC:
169 panic("audit: %s\n", message); 169 panic("audit: %s\n", message);
170 break; 170 break;
171 } 171 }
172 } 172 }
173 173
174 static inline int audit_rate_check(void) 174 static inline int audit_rate_check(void)
175 { 175 {
176 static unsigned long last_check = 0; 176 static unsigned long last_check = 0;
177 static int messages = 0; 177 static int messages = 0;
178 static DEFINE_SPINLOCK(lock); 178 static DEFINE_SPINLOCK(lock);
179 unsigned long flags; 179 unsigned long flags;
180 unsigned long now; 180 unsigned long now;
181 unsigned long elapsed; 181 unsigned long elapsed;
182 int retval = 0; 182 int retval = 0;
183 183
184 if (!audit_rate_limit) return 1; 184 if (!audit_rate_limit) return 1;
185 185
186 spin_lock_irqsave(&lock, flags); 186 spin_lock_irqsave(&lock, flags);
187 if (++messages < audit_rate_limit) { 187 if (++messages < audit_rate_limit) {
188 retval = 1; 188 retval = 1;
189 } else { 189 } else {
190 now = jiffies; 190 now = jiffies;
191 elapsed = now - last_check; 191 elapsed = now - last_check;
192 if (elapsed > HZ) { 192 if (elapsed > HZ) {
193 last_check = now; 193 last_check = now;
194 messages = 0; 194 messages = 0;
195 retval = 1; 195 retval = 1;
196 } 196 }
197 } 197 }
198 spin_unlock_irqrestore(&lock, flags); 198 spin_unlock_irqrestore(&lock, flags);
199 199
200 return retval; 200 return retval;
201 } 201 }
202 202
203 /** 203 /**
204 * audit_log_lost - conditionally log lost audit message event 204 * audit_log_lost - conditionally log lost audit message event
205 * @message: the message stating reason for lost audit message 205 * @message: the message stating reason for lost audit message
206 * 206 *
207 * Emit at least 1 message per second, even if audit_rate_check is 207 * Emit at least 1 message per second, even if audit_rate_check is
208 * throttling. 208 * throttling.
209 * Always increment the lost messages counter. 209 * Always increment the lost messages counter.
210 */ 210 */
211 void audit_log_lost(const char *message) 211 void audit_log_lost(const char *message)
212 { 212 {
213 static unsigned long last_msg = 0; 213 static unsigned long last_msg = 0;
214 static DEFINE_SPINLOCK(lock); 214 static DEFINE_SPINLOCK(lock);
215 unsigned long flags; 215 unsigned long flags;
216 unsigned long now; 216 unsigned long now;
217 int print; 217 int print;
218 218
219 atomic_inc(&audit_lost); 219 atomic_inc(&audit_lost);
220 220
221 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit); 221 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
222 222
223 if (!print) { 223 if (!print) {
224 spin_lock_irqsave(&lock, flags); 224 spin_lock_irqsave(&lock, flags);
225 now = jiffies; 225 now = jiffies;
226 if (now - last_msg > HZ) { 226 if (now - last_msg > HZ) {
227 print = 1; 227 print = 1;
228 last_msg = now; 228 last_msg = now;
229 } 229 }
230 spin_unlock_irqrestore(&lock, flags); 230 spin_unlock_irqrestore(&lock, flags);
231 } 231 }
232 232
233 if (print) { 233 if (print) {
234 printk(KERN_WARNING 234 printk(KERN_WARNING
235 "audit: audit_lost=%d audit_rate_limit=%d audit_backlog_limit=%d\n", 235 "audit: audit_lost=%d audit_rate_limit=%d audit_backlog_limit=%d\n",
236 atomic_read(&audit_lost), 236 atomic_read(&audit_lost),
237 audit_rate_limit, 237 audit_rate_limit,
238 audit_backlog_limit); 238 audit_backlog_limit);
239 audit_panic(message); 239 audit_panic(message);
240 } 240 }
241 } 241 }
242 242
243 static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid) 243 static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid)
244 { 244 {
245 int res, rc = 0, old = audit_rate_limit; 245 int res, rc = 0, old = audit_rate_limit;
246 246
247 /* check if we are locked */ 247 /* check if we are locked */
248 if (audit_enabled == 2) 248 if (audit_enabled == 2)
249 res = 0; 249 res = 0;
250 else 250 else
251 res = 1; 251 res = 1;
252 252
253 if (sid) { 253 if (sid) {
254 char *ctx = NULL; 254 char *ctx = NULL;
255 u32 len; 255 u32 len;
256 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { 256 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
257 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 257 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
258 "audit_rate_limit=%d old=%d by auid=%u" 258 "audit_rate_limit=%d old=%d by auid=%u"
259 " subj=%s res=%d", 259 " subj=%s res=%d",
260 limit, old, loginuid, ctx, res); 260 limit, old, loginuid, ctx, res);
261 kfree(ctx); 261 kfree(ctx);
262 } else 262 } else
263 res = 0; /* Something weird, deny request */ 263 res = 0; /* Something weird, deny request */
264 } 264 }
265 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 265 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
266 "audit_rate_limit=%d old=%d by auid=%u res=%d", 266 "audit_rate_limit=%d old=%d by auid=%u res=%d",
267 limit, old, loginuid, res); 267 limit, old, loginuid, res);
268 268
269 /* If we are allowed, make the change */ 269 /* If we are allowed, make the change */
270 if (res == 1) 270 if (res == 1)
271 audit_rate_limit = limit; 271 audit_rate_limit = limit;
272 /* Not allowed, update reason */ 272 /* Not allowed, update reason */
273 else if (rc == 0) 273 else if (rc == 0)
274 rc = -EPERM; 274 rc = -EPERM;
275 return rc; 275 return rc;
276 } 276 }
277 277
278 static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid) 278 static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid)
279 { 279 {
280 int res, rc = 0, old = audit_backlog_limit; 280 int res, rc = 0, old = audit_backlog_limit;
281 281
282 /* check if we are locked */ 282 /* check if we are locked */
283 if (audit_enabled == 2) 283 if (audit_enabled == 2)
284 res = 0; 284 res = 0;
285 else 285 else
286 res = 1; 286 res = 1;
287 287
288 if (sid) { 288 if (sid) {
289 char *ctx = NULL; 289 char *ctx = NULL;
290 u32 len; 290 u32 len;
291 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { 291 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
292 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 292 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
293 "audit_backlog_limit=%d old=%d by auid=%u" 293 "audit_backlog_limit=%d old=%d by auid=%u"
294 " subj=%s res=%d", 294 " subj=%s res=%d",
295 limit, old, loginuid, ctx, res); 295 limit, old, loginuid, ctx, res);
296 kfree(ctx); 296 kfree(ctx);
297 } else 297 } else
298 res = 0; /* Something weird, deny request */ 298 res = 0; /* Something weird, deny request */
299 } 299 }
300 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 300 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
301 "audit_backlog_limit=%d old=%d by auid=%u res=%d", 301 "audit_backlog_limit=%d old=%d by auid=%u res=%d",
302 limit, old, loginuid, res); 302 limit, old, loginuid, res);
303 303
304 /* If we are allowed, make the change */ 304 /* If we are allowed, make the change */
305 if (res == 1) 305 if (res == 1)
306 audit_backlog_limit = limit; 306 audit_backlog_limit = limit;
307 /* Not allowed, update reason */ 307 /* Not allowed, update reason */
308 else if (rc == 0) 308 else if (rc == 0)
309 rc = -EPERM; 309 rc = -EPERM;
310 return rc; 310 return rc;
311 } 311 }
312 312
313 static int audit_set_enabled(int state, uid_t loginuid, u32 sid) 313 static int audit_set_enabled(int state, uid_t loginuid, u32 sid)
314 { 314 {
315 int res, rc = 0, old = audit_enabled; 315 int res, rc = 0, old = audit_enabled;
316 316
317 if (state < 0 || state > 2) 317 if (state < 0 || state > 2)
318 return -EINVAL; 318 return -EINVAL;
319 319
320 /* check if we are locked */ 320 /* check if we are locked */
321 if (audit_enabled == 2) 321 if (audit_enabled == 2)
322 res = 0; 322 res = 0;
323 else 323 else
324 res = 1; 324 res = 1;
325 325
326 if (sid) { 326 if (sid) {
327 char *ctx = NULL; 327 char *ctx = NULL;
328 u32 len; 328 u32 len;
329 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { 329 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
330 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 330 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
331 "audit_enabled=%d old=%d by auid=%u" 331 "audit_enabled=%d old=%d by auid=%u"
332 " subj=%s res=%d", 332 " subj=%s res=%d",
333 state, old, loginuid, ctx, res); 333 state, old, loginuid, ctx, res);
334 kfree(ctx); 334 kfree(ctx);
335 } else 335 } else
336 res = 0; /* Something weird, deny request */ 336 res = 0; /* Something weird, deny request */
337 } 337 }
338 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 338 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
339 "audit_enabled=%d old=%d by auid=%u res=%d", 339 "audit_enabled=%d old=%d by auid=%u res=%d",
340 state, old, loginuid, res); 340 state, old, loginuid, res);
341 341
342 /* If we are allowed, make the change */ 342 /* If we are allowed, make the change */
343 if (res == 1) 343 if (res == 1)
344 audit_enabled = state; 344 audit_enabled = state;
345 /* Not allowed, update reason */ 345 /* Not allowed, update reason */
346 else if (rc == 0) 346 else if (rc == 0)
347 rc = -EPERM; 347 rc = -EPERM;
348 return rc; 348 return rc;
349 } 349 }
350 350
351 static int audit_set_failure(int state, uid_t loginuid, u32 sid) 351 static int audit_set_failure(int state, uid_t loginuid, u32 sid)
352 { 352 {
353 int res, rc = 0, old = audit_failure; 353 int res, rc = 0, old = audit_failure;
354 354
355 if (state != AUDIT_FAIL_SILENT 355 if (state != AUDIT_FAIL_SILENT
356 && state != AUDIT_FAIL_PRINTK 356 && state != AUDIT_FAIL_PRINTK
357 && state != AUDIT_FAIL_PANIC) 357 && state != AUDIT_FAIL_PANIC)
358 return -EINVAL; 358 return -EINVAL;
359 359
360 /* check if we are locked */ 360 /* check if we are locked */
361 if (audit_enabled == 2) 361 if (audit_enabled == 2)
362 res = 0; 362 res = 0;
363 else 363 else
364 res = 1; 364 res = 1;
365 365
366 if (sid) { 366 if (sid) {
367 char *ctx = NULL; 367 char *ctx = NULL;
368 u32 len; 368 u32 len;
369 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { 369 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
370 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 370 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
371 "audit_failure=%d old=%d by auid=%u" 371 "audit_failure=%d old=%d by auid=%u"
372 " subj=%s res=%d", 372 " subj=%s res=%d",
373 state, old, loginuid, ctx, res); 373 state, old, loginuid, ctx, res);
374 kfree(ctx); 374 kfree(ctx);
375 } else 375 } else
376 res = 0; /* Something weird, deny request */ 376 res = 0; /* Something weird, deny request */
377 } 377 }
378 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 378 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
379 "audit_failure=%d old=%d by auid=%u res=%d", 379 "audit_failure=%d old=%d by auid=%u res=%d",
380 state, old, loginuid, res); 380 state, old, loginuid, res);
381 381
382 /* If we are allowed, make the change */ 382 /* If we are allowed, make the change */
383 if (res == 1) 383 if (res == 1)
384 audit_failure = state; 384 audit_failure = state;
385 /* Not allowed, update reason */ 385 /* Not allowed, update reason */
386 else if (rc == 0) 386 else if (rc == 0)
387 rc = -EPERM; 387 rc = -EPERM;
388 return rc; 388 return rc;
389 } 389 }
390 390
391 static int kauditd_thread(void *dummy) 391 static int kauditd_thread(void *dummy)
392 { 392 {
393 struct sk_buff *skb; 393 struct sk_buff *skb;
394 394
395 set_freezable(); 395 set_freezable();
396 while (!kthread_should_stop()) { 396 while (!kthread_should_stop()) {
397 skb = skb_dequeue(&audit_skb_queue); 397 skb = skb_dequeue(&audit_skb_queue);
398 wake_up(&audit_backlog_wait); 398 wake_up(&audit_backlog_wait);
399 if (skb) { 399 if (skb) {
400 if (audit_pid) { 400 if (audit_pid) {
401 int err = netlink_unicast(audit_sock, skb, audit_pid, 0); 401 int err = netlink_unicast(audit_sock, skb, audit_pid, 0);
402 if (err < 0) { 402 if (err < 0) {
403 BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */ 403 BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */
404 printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid); 404 printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
405 audit_pid = 0; 405 audit_pid = 0;
406 } 406 }
407 } else { 407 } else {
408 printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0)); 408 printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0));
409 kfree_skb(skb); 409 kfree_skb(skb);
410 } 410 }
411 } else { 411 } else {
412 DECLARE_WAITQUEUE(wait, current); 412 DECLARE_WAITQUEUE(wait, current);
413 set_current_state(TASK_INTERRUPTIBLE); 413 set_current_state(TASK_INTERRUPTIBLE);
414 add_wait_queue(&kauditd_wait, &wait); 414 add_wait_queue(&kauditd_wait, &wait);
415 415
416 if (!skb_queue_len(&audit_skb_queue)) { 416 if (!skb_queue_len(&audit_skb_queue)) {
417 try_to_freeze(); 417 try_to_freeze();
418 schedule(); 418 schedule();
419 } 419 }
420 420
421 __set_current_state(TASK_RUNNING); 421 __set_current_state(TASK_RUNNING);
422 remove_wait_queue(&kauditd_wait, &wait); 422 remove_wait_queue(&kauditd_wait, &wait);
423 } 423 }
424 } 424 }
425 return 0; 425 return 0;
426 } 426 }
427 427
428 static int audit_prepare_user_tty(pid_t pid, uid_t loginuid) 428 static int audit_prepare_user_tty(pid_t pid, uid_t loginuid)
429 { 429 {
430 struct task_struct *tsk; 430 struct task_struct *tsk;
431 int err; 431 int err;
432 432
433 read_lock(&tasklist_lock); 433 read_lock(&tasklist_lock);
434 tsk = find_task_by_pid(pid); 434 tsk = find_task_by_pid(pid);
435 err = -ESRCH; 435 err = -ESRCH;
436 if (!tsk) 436 if (!tsk)
437 goto out; 437 goto out;
438 err = 0; 438 err = 0;
439 439
440 spin_lock_irq(&tsk->sighand->siglock); 440 spin_lock_irq(&tsk->sighand->siglock);
441 if (!tsk->signal->audit_tty) 441 if (!tsk->signal->audit_tty)
442 err = -EPERM; 442 err = -EPERM;
443 spin_unlock_irq(&tsk->sighand->siglock); 443 spin_unlock_irq(&tsk->sighand->siglock);
444 if (err) 444 if (err)
445 goto out; 445 goto out;
446 446
447 tty_audit_push_task(tsk, loginuid); 447 tty_audit_push_task(tsk, loginuid);
448 out: 448 out:
449 read_unlock(&tasklist_lock); 449 read_unlock(&tasklist_lock);
450 return err; 450 return err;
451 } 451 }
452 452
453 int audit_send_list(void *_dest) 453 int audit_send_list(void *_dest)
454 { 454 {
455 struct audit_netlink_list *dest = _dest; 455 struct audit_netlink_list *dest = _dest;
456 int pid = dest->pid; 456 int pid = dest->pid;
457 struct sk_buff *skb; 457 struct sk_buff *skb;
458 458
459 /* wait for parent to finish and send an ACK */ 459 /* wait for parent to finish and send an ACK */
460 mutex_lock(&audit_cmd_mutex); 460 mutex_lock(&audit_cmd_mutex);
461 mutex_unlock(&audit_cmd_mutex); 461 mutex_unlock(&audit_cmd_mutex);
462 462
463 while ((skb = __skb_dequeue(&dest->q)) != NULL) 463 while ((skb = __skb_dequeue(&dest->q)) != NULL)
464 netlink_unicast(audit_sock, skb, pid, 0); 464 netlink_unicast(audit_sock, skb, pid, 0);
465 465
466 kfree(dest); 466 kfree(dest);
467 467
468 return 0; 468 return 0;
469 } 469 }
470 470
471 struct sk_buff *audit_make_reply(int pid, int seq, int type, int done, 471 struct sk_buff *audit_make_reply(int pid, int seq, int type, int done,
472 int multi, void *payload, int size) 472 int multi, void *payload, int size)
473 { 473 {
474 struct sk_buff *skb; 474 struct sk_buff *skb;
475 struct nlmsghdr *nlh; 475 struct nlmsghdr *nlh;
476 int len = NLMSG_SPACE(size); 476 int len = NLMSG_SPACE(size);
477 void *data; 477 void *data;
478 int flags = multi ? NLM_F_MULTI : 0; 478 int flags = multi ? NLM_F_MULTI : 0;
479 int t = done ? NLMSG_DONE : type; 479 int t = done ? NLMSG_DONE : type;
480 480
481 skb = alloc_skb(len, GFP_KERNEL); 481 skb = alloc_skb(len, GFP_KERNEL);
482 if (!skb) 482 if (!skb)
483 return NULL; 483 return NULL;
484 484
485 nlh = NLMSG_PUT(skb, pid, seq, t, size); 485 nlh = NLMSG_PUT(skb, pid, seq, t, size);
486 nlh->nlmsg_flags = flags; 486 nlh->nlmsg_flags = flags;
487 data = NLMSG_DATA(nlh); 487 data = NLMSG_DATA(nlh);
488 memcpy(data, payload, size); 488 memcpy(data, payload, size);
489 return skb; 489 return skb;
490 490
491 nlmsg_failure: /* Used by NLMSG_PUT */ 491 nlmsg_failure: /* Used by NLMSG_PUT */
492 if (skb) 492 if (skb)
493 kfree_skb(skb); 493 kfree_skb(skb);
494 return NULL; 494 return NULL;
495 } 495 }
496 496
497 /** 497 /**
498 * audit_send_reply - send an audit reply message via netlink 498 * audit_send_reply - send an audit reply message via netlink
499 * @pid: process id to send reply to 499 * @pid: process id to send reply to
500 * @seq: sequence number 500 * @seq: sequence number
501 * @type: audit message type 501 * @type: audit message type
502 * @done: done (last) flag 502 * @done: done (last) flag
503 * @multi: multi-part message flag 503 * @multi: multi-part message flag
504 * @payload: payload data 504 * @payload: payload data
505 * @size: payload size 505 * @size: payload size
506 * 506 *
507 * Allocates an skb, builds the netlink message, and sends it to the pid. 507 * Allocates an skb, builds the netlink message, and sends it to the pid.
508 * No failure notifications. 508 * No failure notifications.
509 */ 509 */
510 void audit_send_reply(int pid, int seq, int type, int done, int multi, 510 void audit_send_reply(int pid, int seq, int type, int done, int multi,
511 void *payload, int size) 511 void *payload, int size)
512 { 512 {
513 struct sk_buff *skb; 513 struct sk_buff *skb;
514 skb = audit_make_reply(pid, seq, type, done, multi, payload, size); 514 skb = audit_make_reply(pid, seq, type, done, multi, payload, size);
515 if (!skb) 515 if (!skb)
516 return; 516 return;
517 /* Ignore failure. It'll only happen if the sender goes away, 517 /* Ignore failure. It'll only happen if the sender goes away,
518 because our timeout is set to infinite. */ 518 because our timeout is set to infinite. */
519 netlink_unicast(audit_sock, skb, pid, 0); 519 netlink_unicast(audit_sock, skb, pid, 0);
520 return; 520 return;
521 } 521 }
522 522
523 /* 523 /*
524 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit 524 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit
525 * control messages. 525 * control messages.
526 */ 526 */
527 static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) 527 static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
528 { 528 {
529 int err = 0; 529 int err = 0;
530 530
531 switch (msg_type) { 531 switch (msg_type) {
532 case AUDIT_GET: 532 case AUDIT_GET:
533 case AUDIT_LIST: 533 case AUDIT_LIST:
534 case AUDIT_LIST_RULES: 534 case AUDIT_LIST_RULES:
535 case AUDIT_SET: 535 case AUDIT_SET:
536 case AUDIT_ADD: 536 case AUDIT_ADD:
537 case AUDIT_ADD_RULE: 537 case AUDIT_ADD_RULE:
538 case AUDIT_DEL: 538 case AUDIT_DEL:
539 case AUDIT_DEL_RULE: 539 case AUDIT_DEL_RULE:
540 case AUDIT_SIGNAL_INFO: 540 case AUDIT_SIGNAL_INFO:
541 case AUDIT_TTY_GET: 541 case AUDIT_TTY_GET:
542 case AUDIT_TTY_SET: 542 case AUDIT_TTY_SET:
543 if (security_netlink_recv(skb, CAP_AUDIT_CONTROL)) 543 if (security_netlink_recv(skb, CAP_AUDIT_CONTROL))
544 err = -EPERM; 544 err = -EPERM;
545 break; 545 break;
546 case AUDIT_USER: 546 case AUDIT_USER:
547 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: 547 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
548 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: 548 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
549 if (security_netlink_recv(skb, CAP_AUDIT_WRITE)) 549 if (security_netlink_recv(skb, CAP_AUDIT_WRITE))
550 err = -EPERM; 550 err = -EPERM;
551 break; 551 break;
552 default: /* bad msg */ 552 default: /* bad msg */
553 err = -EINVAL; 553 err = -EINVAL;
554 } 554 }
555 555
556 return err; 556 return err;
557 } 557 }
558 558
559 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 559 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
560 { 560 {
561 u32 uid, pid, seq, sid; 561 u32 uid, pid, seq, sid;
562 void *data; 562 void *data;
563 struct audit_status *status_get, status_set; 563 struct audit_status *status_get, status_set;
564 int err; 564 int err;
565 struct audit_buffer *ab; 565 struct audit_buffer *ab;
566 u16 msg_type = nlh->nlmsg_type; 566 u16 msg_type = nlh->nlmsg_type;
567 uid_t loginuid; /* loginuid of sender */ 567 uid_t loginuid; /* loginuid of sender */
568 struct audit_sig_info *sig_data; 568 struct audit_sig_info *sig_data;
569 char *ctx; 569 char *ctx;
570 u32 len; 570 u32 len;
571 571
572 err = audit_netlink_ok(skb, msg_type); 572 err = audit_netlink_ok(skb, msg_type);
573 if (err) 573 if (err)
574 return err; 574 return err;
575 575
576 /* As soon as there's any sign of userspace auditd, 576 /* As soon as there's any sign of userspace auditd,
577 * start kauditd to talk to it */ 577 * start kauditd to talk to it */
578 if (!kauditd_task) 578 if (!kauditd_task)
579 kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd"); 579 kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
580 if (IS_ERR(kauditd_task)) { 580 if (IS_ERR(kauditd_task)) {
581 err = PTR_ERR(kauditd_task); 581 err = PTR_ERR(kauditd_task);
582 kauditd_task = NULL; 582 kauditd_task = NULL;
583 return err; 583 return err;
584 } 584 }
585 585
586 pid = NETLINK_CREDS(skb)->pid; 586 pid = NETLINK_CREDS(skb)->pid;
587 uid = NETLINK_CREDS(skb)->uid; 587 uid = NETLINK_CREDS(skb)->uid;
588 loginuid = NETLINK_CB(skb).loginuid; 588 loginuid = NETLINK_CB(skb).loginuid;
589 sid = NETLINK_CB(skb).sid; 589 sid = NETLINK_CB(skb).sid;
590 seq = nlh->nlmsg_seq; 590 seq = nlh->nlmsg_seq;
591 data = NLMSG_DATA(nlh); 591 data = NLMSG_DATA(nlh);
592 592
593 switch (msg_type) { 593 switch (msg_type) {
594 case AUDIT_GET: 594 case AUDIT_GET:
595 status_set.enabled = audit_enabled; 595 status_set.enabled = audit_enabled;
596 status_set.failure = audit_failure; 596 status_set.failure = audit_failure;
597 status_set.pid = audit_pid; 597 status_set.pid = audit_pid;
598 status_set.rate_limit = audit_rate_limit; 598 status_set.rate_limit = audit_rate_limit;
599 status_set.backlog_limit = audit_backlog_limit; 599 status_set.backlog_limit = audit_backlog_limit;
600 status_set.lost = atomic_read(&audit_lost); 600 status_set.lost = atomic_read(&audit_lost);
601 status_set.backlog = skb_queue_len(&audit_skb_queue); 601 status_set.backlog = skb_queue_len(&audit_skb_queue);
602 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0, 602 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
603 &status_set, sizeof(status_set)); 603 &status_set, sizeof(status_set));
604 break; 604 break;
605 case AUDIT_SET: 605 case AUDIT_SET:
606 if (nlh->nlmsg_len < sizeof(struct audit_status)) 606 if (nlh->nlmsg_len < sizeof(struct audit_status))
607 return -EINVAL; 607 return -EINVAL;
608 status_get = (struct audit_status *)data; 608 status_get = (struct audit_status *)data;
609 if (status_get->mask & AUDIT_STATUS_ENABLED) { 609 if (status_get->mask & AUDIT_STATUS_ENABLED) {
610 err = audit_set_enabled(status_get->enabled, 610 err = audit_set_enabled(status_get->enabled,
611 loginuid, sid); 611 loginuid, sid);
612 if (err < 0) return err; 612 if (err < 0) return err;
613 } 613 }
614 if (status_get->mask & AUDIT_STATUS_FAILURE) { 614 if (status_get->mask & AUDIT_STATUS_FAILURE) {
615 err = audit_set_failure(status_get->failure, 615 err = audit_set_failure(status_get->failure,
616 loginuid, sid); 616 loginuid, sid);
617 if (err < 0) return err; 617 if (err < 0) return err;
618 } 618 }
619 if (status_get->mask & AUDIT_STATUS_PID) { 619 if (status_get->mask & AUDIT_STATUS_PID) {
620 int old = audit_pid; 620 int old = audit_pid;
621 if (sid) { 621 if (sid) {
622 if ((err = selinux_sid_to_string( 622 if ((err = selinux_sid_to_string(
623 sid, &ctx, &len))) 623 sid, &ctx, &len)))
624 return err; 624 return err;
625 else 625 else
626 audit_log(NULL, GFP_KERNEL, 626 audit_log(NULL, GFP_KERNEL,
627 AUDIT_CONFIG_CHANGE, 627 AUDIT_CONFIG_CHANGE,
628 "audit_pid=%d old=%d by auid=%u subj=%s", 628 "audit_pid=%d old=%d by auid=%u subj=%s",
629 status_get->pid, old, 629 status_get->pid, old,
630 loginuid, ctx); 630 loginuid, ctx);
631 kfree(ctx); 631 kfree(ctx);
632 } else 632 } else
633 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 633 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
634 "audit_pid=%d old=%d by auid=%u", 634 "audit_pid=%d old=%d by auid=%u",
635 status_get->pid, old, loginuid); 635 status_get->pid, old, loginuid);
636 audit_pid = status_get->pid; 636 audit_pid = status_get->pid;
637 } 637 }
638 if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) 638 if (status_get->mask & AUDIT_STATUS_RATE_LIMIT)
639 err = audit_set_rate_limit(status_get->rate_limit, 639 err = audit_set_rate_limit(status_get->rate_limit,
640 loginuid, sid); 640 loginuid, sid);
641 if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT) 641 if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
642 err = audit_set_backlog_limit(status_get->backlog_limit, 642 err = audit_set_backlog_limit(status_get->backlog_limit,
643 loginuid, sid); 643 loginuid, sid);
644 break; 644 break;
645 case AUDIT_USER: 645 case AUDIT_USER:
646 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: 646 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
647 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: 647 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
648 if (!audit_enabled && msg_type != AUDIT_USER_AVC) 648 if (!audit_enabled && msg_type != AUDIT_USER_AVC)
649 return 0; 649 return 0;
650 650
651 err = audit_filter_user(&NETLINK_CB(skb), msg_type); 651 err = audit_filter_user(&NETLINK_CB(skb), msg_type);
652 if (err == 1) { 652 if (err == 1) {
653 err = 0; 653 err = 0;
654 if (msg_type == AUDIT_USER_TTY) { 654 if (msg_type == AUDIT_USER_TTY) {
655 err = audit_prepare_user_tty(pid, loginuid); 655 err = audit_prepare_user_tty(pid, loginuid);
656 if (err) 656 if (err)
657 break; 657 break;
658 } 658 }
659 ab = audit_log_start(NULL, GFP_KERNEL, msg_type); 659 ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
660 if (ab) { 660 if (ab) {
661 audit_log_format(ab, 661 audit_log_format(ab,
662 "user pid=%d uid=%u auid=%u", 662 "user pid=%d uid=%u auid=%u",
663 pid, uid, loginuid); 663 pid, uid, loginuid);
664 if (sid) { 664 if (sid) {
665 if (selinux_sid_to_string( 665 if (selinux_sid_to_string(
666 sid, &ctx, &len)) { 666 sid, &ctx, &len)) {
667 audit_log_format(ab, 667 audit_log_format(ab,
668 " ssid=%u", sid); 668 " ssid=%u", sid);
669 /* Maybe call audit_panic? */ 669 /* Maybe call audit_panic? */
670 } else 670 } else
671 audit_log_format(ab, 671 audit_log_format(ab,
672 " subj=%s", ctx); 672 " subj=%s", ctx);
673 kfree(ctx); 673 kfree(ctx);
674 } 674 }
675 if (msg_type != AUDIT_USER_TTY) 675 if (msg_type != AUDIT_USER_TTY)
676 audit_log_format(ab, " msg='%.1024s'", 676 audit_log_format(ab, " msg='%.1024s'",
677 (char *)data); 677 (char *)data);
678 else { 678 else {
679 int size; 679 int size;
680 680
681 audit_log_format(ab, " msg="); 681 audit_log_format(ab, " msg=");
682 size = nlmsg_len(nlh); 682 size = nlmsg_len(nlh);
683 audit_log_n_untrustedstring(ab, size, 683 audit_log_n_untrustedstring(ab, size,
684 data); 684 data);
685 } 685 }
686 audit_set_pid(ab, pid); 686 audit_set_pid(ab, pid);
687 audit_log_end(ab); 687 audit_log_end(ab);
688 } 688 }
689 } 689 }
690 break; 690 break;
691 case AUDIT_ADD: 691 case AUDIT_ADD:
692 case AUDIT_DEL: 692 case AUDIT_DEL:
693 if (nlmsg_len(nlh) < sizeof(struct audit_rule)) 693 if (nlmsg_len(nlh) < sizeof(struct audit_rule))
694 return -EINVAL; 694 return -EINVAL;
695 if (audit_enabled == 2) { 695 if (audit_enabled == 2) {
696 ab = audit_log_start(NULL, GFP_KERNEL, 696 ab = audit_log_start(NULL, GFP_KERNEL,
697 AUDIT_CONFIG_CHANGE); 697 AUDIT_CONFIG_CHANGE);
698 if (ab) { 698 if (ab) {
699 audit_log_format(ab, 699 audit_log_format(ab,
700 "pid=%d uid=%u auid=%u", 700 "pid=%d uid=%u auid=%u",
701 pid, uid, loginuid); 701 pid, uid, loginuid);
702 if (sid) { 702 if (sid) {
703 if (selinux_sid_to_string( 703 if (selinux_sid_to_string(
704 sid, &ctx, &len)) { 704 sid, &ctx, &len)) {
705 audit_log_format(ab, 705 audit_log_format(ab,
706 " ssid=%u", sid); 706 " ssid=%u", sid);
707 /* Maybe call audit_panic? */ 707 /* Maybe call audit_panic? */
708 } else 708 } else
709 audit_log_format(ab, 709 audit_log_format(ab,
710 " subj=%s", ctx); 710 " subj=%s", ctx);
711 kfree(ctx); 711 kfree(ctx);
712 } 712 }
713 audit_log_format(ab, " audit_enabled=%d res=0", 713 audit_log_format(ab, " audit_enabled=%d res=0",
714 audit_enabled); 714 audit_enabled);
715 audit_log_end(ab); 715 audit_log_end(ab);
716 } 716 }
717 return -EPERM; 717 return -EPERM;
718 } 718 }
719 /* fallthrough */ 719 /* fallthrough */
720 case AUDIT_LIST: 720 case AUDIT_LIST:
721 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid, 721 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
722 uid, seq, data, nlmsg_len(nlh), 722 uid, seq, data, nlmsg_len(nlh),
723 loginuid, sid); 723 loginuid, sid);
724 break; 724 break;
725 case AUDIT_ADD_RULE: 725 case AUDIT_ADD_RULE:
726 case AUDIT_DEL_RULE: 726 case AUDIT_DEL_RULE:
727 if (nlmsg_len(nlh) < sizeof(struct audit_rule_data)) 727 if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
728 return -EINVAL; 728 return -EINVAL;
729 if (audit_enabled == 2) { 729 if (audit_enabled == 2) {
730 ab = audit_log_start(NULL, GFP_KERNEL, 730 ab = audit_log_start(NULL, GFP_KERNEL,
731 AUDIT_CONFIG_CHANGE); 731 AUDIT_CONFIG_CHANGE);
732 if (ab) { 732 if (ab) {
733 audit_log_format(ab, 733 audit_log_format(ab,
734 "pid=%d uid=%u auid=%u", 734 "pid=%d uid=%u auid=%u",
735 pid, uid, loginuid); 735 pid, uid, loginuid);
736 if (sid) { 736 if (sid) {
737 if (selinux_sid_to_string( 737 if (selinux_sid_to_string(
738 sid, &ctx, &len)) { 738 sid, &ctx, &len)) {
739 audit_log_format(ab, 739 audit_log_format(ab,
740 " ssid=%u", sid); 740 " ssid=%u", sid);
741 /* Maybe call audit_panic? */ 741 /* Maybe call audit_panic? */
742 } else 742 } else
743 audit_log_format(ab, 743 audit_log_format(ab,
744 " subj=%s", ctx); 744 " subj=%s", ctx);
745 kfree(ctx); 745 kfree(ctx);
746 } 746 }
747 audit_log_format(ab, " audit_enabled=%d res=0", 747 audit_log_format(ab, " audit_enabled=%d res=0",
748 audit_enabled); 748 audit_enabled);
749 audit_log_end(ab); 749 audit_log_end(ab);
750 } 750 }
751 return -EPERM; 751 return -EPERM;
752 } 752 }
753 /* fallthrough */ 753 /* fallthrough */
754 case AUDIT_LIST_RULES: 754 case AUDIT_LIST_RULES:
755 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid, 755 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
756 uid, seq, data, nlmsg_len(nlh), 756 uid, seq, data, nlmsg_len(nlh),
757 loginuid, sid); 757 loginuid, sid);
758 break; 758 break;
759 case AUDIT_SIGNAL_INFO: 759 case AUDIT_SIGNAL_INFO:
760 err = selinux_sid_to_string(audit_sig_sid, &ctx, &len); 760 err = selinux_sid_to_string(audit_sig_sid, &ctx, &len);
761 if (err) 761 if (err)
762 return err; 762 return err;
763 sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL); 763 sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
764 if (!sig_data) { 764 if (!sig_data) {
765 kfree(ctx); 765 kfree(ctx);
766 return -ENOMEM; 766 return -ENOMEM;
767 } 767 }
768 sig_data->uid = audit_sig_uid; 768 sig_data->uid = audit_sig_uid;
769 sig_data->pid = audit_sig_pid; 769 sig_data->pid = audit_sig_pid;
770 memcpy(sig_data->ctx, ctx, len); 770 memcpy(sig_data->ctx, ctx, len);
771 kfree(ctx); 771 kfree(ctx);
772 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO, 772 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO,
773 0, 0, sig_data, sizeof(*sig_data) + len); 773 0, 0, sig_data, sizeof(*sig_data) + len);
774 kfree(sig_data); 774 kfree(sig_data);
775 break; 775 break;
776 case AUDIT_TTY_GET: { 776 case AUDIT_TTY_GET: {
777 struct audit_tty_status s; 777 struct audit_tty_status s;
778 struct task_struct *tsk; 778 struct task_struct *tsk;
779 779
780 read_lock(&tasklist_lock); 780 read_lock(&tasklist_lock);
781 tsk = find_task_by_pid(pid); 781 tsk = find_task_by_pid(pid);
782 if (!tsk) 782 if (!tsk)
783 err = -ESRCH; 783 err = -ESRCH;
784 else { 784 else {
785 spin_lock_irq(&tsk->sighand->siglock); 785 spin_lock_irq(&tsk->sighand->siglock);
786 s.enabled = tsk->signal->audit_tty != 0; 786 s.enabled = tsk->signal->audit_tty != 0;
787 spin_unlock_irq(&tsk->sighand->siglock); 787 spin_unlock_irq(&tsk->sighand->siglock);
788 } 788 }
789 read_unlock(&tasklist_lock); 789 read_unlock(&tasklist_lock);
790 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0, 790 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
791 &s, sizeof(s)); 791 &s, sizeof(s));
792 break; 792 break;
793 } 793 }
794 case AUDIT_TTY_SET: { 794 case AUDIT_TTY_SET: {
795 struct audit_tty_status *s; 795 struct audit_tty_status *s;
796 struct task_struct *tsk; 796 struct task_struct *tsk;
797 797
798 if (nlh->nlmsg_len < sizeof(struct audit_tty_status)) 798 if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
799 return -EINVAL; 799 return -EINVAL;
800 s = data; 800 s = data;
801 if (s->enabled != 0 && s->enabled != 1) 801 if (s->enabled != 0 && s->enabled != 1)
802 return -EINVAL; 802 return -EINVAL;
803 read_lock(&tasklist_lock); 803 read_lock(&tasklist_lock);
804 tsk = find_task_by_pid(pid); 804 tsk = find_task_by_pid(pid);
805 if (!tsk) 805 if (!tsk)
806 err = -ESRCH; 806 err = -ESRCH;
807 else { 807 else {
808 spin_lock_irq(&tsk->sighand->siglock); 808 spin_lock_irq(&tsk->sighand->siglock);
809 tsk->signal->audit_tty = s->enabled != 0; 809 tsk->signal->audit_tty = s->enabled != 0;
810 spin_unlock_irq(&tsk->sighand->siglock); 810 spin_unlock_irq(&tsk->sighand->siglock);
811 } 811 }
812 read_unlock(&tasklist_lock); 812 read_unlock(&tasklist_lock);
813 break; 813 break;
814 } 814 }
815 default: 815 default:
816 err = -EINVAL; 816 err = -EINVAL;
817 break; 817 break;
818 } 818 }
819 819
820 return err < 0 ? err : 0; 820 return err < 0 ? err : 0;
821 } 821 }
822 822
823 /* 823 /*
824 * Get message from skb (based on rtnetlink_rcv_skb). Each message is 824 * Get message from skb (based on rtnetlink_rcv_skb). Each message is
825 * processed by audit_receive_msg. Malformed skbs with wrong length are 825 * processed by audit_receive_msg. Malformed skbs with wrong length are
826 * discarded silently. 826 * discarded silently.
827 */ 827 */
828 static void audit_receive_skb(struct sk_buff *skb) 828 static void audit_receive_skb(struct sk_buff *skb)
829 { 829 {
830 int err; 830 int err;
831 struct nlmsghdr *nlh; 831 struct nlmsghdr *nlh;
832 u32 rlen; 832 u32 rlen;
833 833
834 while (skb->len >= NLMSG_SPACE(0)) { 834 while (skb->len >= NLMSG_SPACE(0)) {
835 nlh = nlmsg_hdr(skb); 835 nlh = nlmsg_hdr(skb);
836 if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) 836 if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
837 return; 837 return;
838 rlen = NLMSG_ALIGN(nlh->nlmsg_len); 838 rlen = NLMSG_ALIGN(nlh->nlmsg_len);
839 if (rlen > skb->len) 839 if (rlen > skb->len)
840 rlen = skb->len; 840 rlen = skb->len;
841 if ((err = audit_receive_msg(skb, nlh))) { 841 if ((err = audit_receive_msg(skb, nlh))) {
842 netlink_ack(skb, nlh, err); 842 netlink_ack(skb, nlh, err);
843 } else if (nlh->nlmsg_flags & NLM_F_ACK) 843 } else if (nlh->nlmsg_flags & NLM_F_ACK)
844 netlink_ack(skb, nlh, 0); 844 netlink_ack(skb, nlh, 0);
845 skb_pull(skb, rlen); 845 skb_pull(skb, rlen);
846 } 846 }
847 } 847 }
848 848
849 /* Receive messages from netlink socket. */ 849 /* Receive messages from netlink socket. */
850 static void audit_receive(struct sk_buff *skb) 850 static void audit_receive(struct sk_buff *skb)
851 { 851 {
852 mutex_lock(&audit_cmd_mutex); 852 mutex_lock(&audit_cmd_mutex);
853 audit_receive_skb(skb); 853 audit_receive_skb(skb);
854 mutex_unlock(&audit_cmd_mutex); 854 mutex_unlock(&audit_cmd_mutex);
855 } 855 }
856 856
857 #ifdef CONFIG_AUDITSYSCALL 857 #ifdef CONFIG_AUDITSYSCALL
858 static const struct inotify_operations audit_inotify_ops = { 858 static const struct inotify_operations audit_inotify_ops = {
859 .handle_event = audit_handle_ievent, 859 .handle_event = audit_handle_ievent,
860 .destroy_watch = audit_free_parent, 860 .destroy_watch = audit_free_parent,
861 }; 861 };
862 #endif 862 #endif
863 863
864 /* Initialize audit support at boot time. */ 864 /* Initialize audit support at boot time. */
865 static int __init audit_init(void) 865 static int __init audit_init(void)
866 { 866 {
867 int i; 867 int i;
868 868
869 printk(KERN_INFO "audit: initializing netlink socket (%s)\n", 869 printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
870 audit_default ? "enabled" : "disabled"); 870 audit_default ? "enabled" : "disabled");
871 audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0, 871 audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0,
872 audit_receive, NULL, THIS_MODULE); 872 audit_receive, NULL, THIS_MODULE);
873 if (!audit_sock) 873 if (!audit_sock)
874 audit_panic("cannot initialize netlink socket"); 874 audit_panic("cannot initialize netlink socket");
875 else 875 else
876 audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; 876 audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
877 877
878 skb_queue_head_init(&audit_skb_queue); 878 skb_queue_head_init(&audit_skb_queue);
879 audit_initialized = 1; 879 audit_initialized = 1;
880 audit_enabled = audit_default; 880 audit_enabled = audit_default;
881 881
882 /* Register the callback with selinux. This callback will be invoked 882 /* Register the callback with selinux. This callback will be invoked
883 * when a new policy is loaded. */ 883 * when a new policy is loaded. */
884 selinux_audit_set_callback(&selinux_audit_rule_update); 884 selinux_audit_set_callback(&selinux_audit_rule_update);
885 885
886 audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized"); 886 audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
887 887
888 #ifdef CONFIG_AUDITSYSCALL 888 #ifdef CONFIG_AUDITSYSCALL
889 audit_ih = inotify_init(&audit_inotify_ops); 889 audit_ih = inotify_init(&audit_inotify_ops);
890 if (IS_ERR(audit_ih)) 890 if (IS_ERR(audit_ih))
891 audit_panic("cannot initialize inotify handle"); 891 audit_panic("cannot initialize inotify handle");
892 #endif 892 #endif
893 893
894 for (i = 0; i < AUDIT_INODE_BUCKETS; i++) 894 for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
895 INIT_LIST_HEAD(&audit_inode_hash[i]); 895 INIT_LIST_HEAD(&audit_inode_hash[i]);
896 896
897 return 0; 897 return 0;
898 } 898 }
899 __initcall(audit_init); 899 __initcall(audit_init);
900 900
901 /* Process kernel command-line parameter at boot time. audit=0 or audit=1. */ 901 /* Process kernel command-line parameter at boot time. audit=0 or audit=1. */
902 static int __init audit_enable(char *str) 902 static int __init audit_enable(char *str)
903 { 903 {
904 audit_default = !!simple_strtol(str, NULL, 0); 904 audit_default = !!simple_strtol(str, NULL, 0);
905 printk(KERN_INFO "audit: %s%s\n", 905 printk(KERN_INFO "audit: %s%s\n",
906 audit_default ? "enabled" : "disabled", 906 audit_default ? "enabled" : "disabled",
907 audit_initialized ? "" : " (after initialization)"); 907 audit_initialized ? "" : " (after initialization)");
908 if (audit_initialized) 908 if (audit_initialized)
909 audit_enabled = audit_default; 909 audit_enabled = audit_default;
910 return 1; 910 return 1;
911 } 911 }
912 912
913 __setup("audit=", audit_enable); 913 __setup("audit=", audit_enable);
914 914
915 static void audit_buffer_free(struct audit_buffer *ab) 915 static void audit_buffer_free(struct audit_buffer *ab)
916 { 916 {
917 unsigned long flags; 917 unsigned long flags;
918 918
919 if (!ab) 919 if (!ab)
920 return; 920 return;
921 921
922 if (ab->skb) 922 if (ab->skb)
923 kfree_skb(ab->skb); 923 kfree_skb(ab->skb);
924 924
925 spin_lock_irqsave(&audit_freelist_lock, flags); 925 spin_lock_irqsave(&audit_freelist_lock, flags);
926 if (audit_freelist_count > AUDIT_MAXFREE) 926 if (audit_freelist_count > AUDIT_MAXFREE)
927 kfree(ab); 927 kfree(ab);
928 else { 928 else {
929 audit_freelist_count++; 929 audit_freelist_count++;
930 list_add(&ab->list, &audit_freelist); 930 list_add(&ab->list, &audit_freelist);
931 } 931 }
932 spin_unlock_irqrestore(&audit_freelist_lock, flags); 932 spin_unlock_irqrestore(&audit_freelist_lock, flags);
933 } 933 }
934 934
935 static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx, 935 static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
936 gfp_t gfp_mask, int type) 936 gfp_t gfp_mask, int type)
937 { 937 {
938 unsigned long flags; 938 unsigned long flags;
939 struct audit_buffer *ab = NULL; 939 struct audit_buffer *ab = NULL;
940 struct nlmsghdr *nlh; 940 struct nlmsghdr *nlh;
941 941
942 spin_lock_irqsave(&audit_freelist_lock, flags); 942 spin_lock_irqsave(&audit_freelist_lock, flags);
943 if (!list_empty(&audit_freelist)) { 943 if (!list_empty(&audit_freelist)) {
944 ab = list_entry(audit_freelist.next, 944 ab = list_entry(audit_freelist.next,
945 struct audit_buffer, list); 945 struct audit_buffer, list);
946 list_del(&ab->list); 946 list_del(&ab->list);
947 --audit_freelist_count; 947 --audit_freelist_count;
948 } 948 }
949 spin_unlock_irqrestore(&audit_freelist_lock, flags); 949 spin_unlock_irqrestore(&audit_freelist_lock, flags);
950 950
951 if (!ab) { 951 if (!ab) {
952 ab = kmalloc(sizeof(*ab), gfp_mask); 952 ab = kmalloc(sizeof(*ab), gfp_mask);
953 if (!ab) 953 if (!ab)
954 goto err; 954 goto err;
955 } 955 }
956 956
957 ab->skb = alloc_skb(AUDIT_BUFSIZ, gfp_mask); 957 ab->skb = alloc_skb(AUDIT_BUFSIZ, gfp_mask);
958 if (!ab->skb) 958 if (!ab->skb)
959 goto err; 959 goto err;
960 960
961 ab->ctx = ctx; 961 ab->ctx = ctx;
962 ab->gfp_mask = gfp_mask; 962 ab->gfp_mask = gfp_mask;
963 nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0)); 963 nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0));
964 nlh->nlmsg_type = type; 964 nlh->nlmsg_type = type;
965 nlh->nlmsg_flags = 0; 965 nlh->nlmsg_flags = 0;
966 nlh->nlmsg_pid = 0; 966 nlh->nlmsg_pid = 0;
967 nlh->nlmsg_seq = 0; 967 nlh->nlmsg_seq = 0;
968 return ab; 968 return ab;
969 err: 969 err:
970 audit_buffer_free(ab); 970 audit_buffer_free(ab);
971 return NULL; 971 return NULL;
972 } 972 }
973 973
974 /** 974 /**
975 * audit_serial - compute a serial number for the audit record 975 * audit_serial - compute a serial number for the audit record
976 * 976 *
977 * Compute a serial number for the audit record. Audit records are 977 * Compute a serial number for the audit record. Audit records are
978 * written to user-space as soon as they are generated, so a complete 978 * written to user-space as soon as they are generated, so a complete
979 * audit record may be written in several pieces. The timestamp of the 979 * audit record may be written in several pieces. The timestamp of the
980 * record and this serial number are used by the user-space tools to 980 * record and this serial number are used by the user-space tools to
981 * determine which pieces belong to the same audit record. The 981 * determine which pieces belong to the same audit record. The
982 * (timestamp,serial) tuple is unique for each syscall and is live from 982 * (timestamp,serial) tuple is unique for each syscall and is live from
983 * syscall entry to syscall exit. 983 * syscall entry to syscall exit.
984 * 984 *
985 * NOTE: Another possibility is to store the formatted records off the 985 * NOTE: Another possibility is to store the formatted records off the
986 * audit context (for those records that have a context), and emit them 986 * audit context (for those records that have a context), and emit them
987 * all at syscall exit. However, this could delay the reporting of 987 * all at syscall exit. However, this could delay the reporting of
988 * significant errors until syscall exit (or never, if the system 988 * significant errors until syscall exit (or never, if the system
989 * halts). 989 * halts).
990 */ 990 */
991 unsigned int audit_serial(void) 991 unsigned int audit_serial(void)
992 { 992 {
993 static DEFINE_SPINLOCK(serial_lock); 993 static DEFINE_SPINLOCK(serial_lock);
994 static unsigned int serial = 0; 994 static unsigned int serial = 0;
995 995
996 unsigned long flags; 996 unsigned long flags;
997 unsigned int ret; 997 unsigned int ret;
998 998
999 spin_lock_irqsave(&serial_lock, flags); 999 spin_lock_irqsave(&serial_lock, flags);
1000 do { 1000 do {
1001 ret = ++serial; 1001 ret = ++serial;
1002 } while (unlikely(!ret)); 1002 } while (unlikely(!ret));
1003 spin_unlock_irqrestore(&serial_lock, flags); 1003 spin_unlock_irqrestore(&serial_lock, flags);
1004 1004
1005 return ret; 1005 return ret;
1006 } 1006 }
1007 1007
1008 static inline void audit_get_stamp(struct audit_context *ctx, 1008 static inline void audit_get_stamp(struct audit_context *ctx,
1009 struct timespec *t, unsigned int *serial) 1009 struct timespec *t, unsigned int *serial)
1010 { 1010 {
1011 if (ctx) 1011 if (ctx)
1012 auditsc_get_stamp(ctx, t, serial); 1012 auditsc_get_stamp(ctx, t, serial);
1013 else { 1013 else {
1014 *t = CURRENT_TIME; 1014 *t = CURRENT_TIME;
1015 *serial = audit_serial(); 1015 *serial = audit_serial();
1016 } 1016 }
1017 } 1017 }
1018 1018
1019 /* Obtain an audit buffer. This routine does locking to obtain the 1019 /* Obtain an audit buffer. This routine does locking to obtain the
1020 * audit buffer, but then no locking is required for calls to 1020 * audit buffer, but then no locking is required for calls to
1021 * audit_log_*format. If the tsk is a task that is currently in a 1021 * audit_log_*format. If the tsk is a task that is currently in a
1022 * syscall, then the syscall is marked as auditable and an audit record 1022 * syscall, then the syscall is marked as auditable and an audit record
1023 * will be written at syscall exit. If there is no associated task, tsk 1023 * will be written at syscall exit. If there is no associated task, tsk
1024 * should be NULL. */ 1024 * should be NULL. */
1025 1025
1026 /** 1026 /**
1027 * audit_log_start - obtain an audit buffer 1027 * audit_log_start - obtain an audit buffer
1028 * @ctx: audit_context (may be NULL) 1028 * @ctx: audit_context (may be NULL)
1029 * @gfp_mask: type of allocation 1029 * @gfp_mask: type of allocation
1030 * @type: audit message type 1030 * @type: audit message type
1031 * 1031 *
1032 * Returns audit_buffer pointer on success or NULL on error. 1032 * Returns audit_buffer pointer on success or NULL on error.
1033 * 1033 *
1034 * Obtain an audit buffer. This routine does locking to obtain the 1034 * Obtain an audit buffer. This routine does locking to obtain the
1035 * audit buffer, but then no locking is required for calls to 1035 * audit buffer, but then no locking is required for calls to
1036 * audit_log_*format. If the task (ctx) is a task that is currently in a 1036 * audit_log_*format. If the task (ctx) is a task that is currently in a
1037 * syscall, then the syscall is marked as auditable and an audit record 1037 * syscall, then the syscall is marked as auditable and an audit record
1038 * will be written at syscall exit. If there is no associated task, then 1038 * will be written at syscall exit. If there is no associated task, then
1039 * task context (ctx) should be NULL. 1039 * task context (ctx) should be NULL.
1040 */ 1040 */
1041 struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, 1041 struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
1042 int type) 1042 int type)
1043 { 1043 {
1044 struct audit_buffer *ab = NULL; 1044 struct audit_buffer *ab = NULL;
1045 struct timespec t; 1045 struct timespec t;
1046 unsigned int serial; 1046 unsigned int serial;
1047 int reserve; 1047 int reserve;
1048 unsigned long timeout_start = jiffies; 1048 unsigned long timeout_start = jiffies;
1049 1049
1050 if (!audit_initialized) 1050 if (!audit_initialized)
1051 return NULL; 1051 return NULL;
1052 1052
1053 if (unlikely(audit_filter_type(type))) 1053 if (unlikely(audit_filter_type(type)))
1054 return NULL; 1054 return NULL;
1055 1055
1056 if (gfp_mask & __GFP_WAIT) 1056 if (gfp_mask & __GFP_WAIT)
1057 reserve = 0; 1057 reserve = 0;
1058 else 1058 else
1059 reserve = 5; /* Allow atomic callers to go up to five 1059 reserve = 5; /* Allow atomic callers to go up to five
1060 entries over the normal backlog limit */ 1060 entries over the normal backlog limit */
1061 1061
1062 while (audit_backlog_limit 1062 while (audit_backlog_limit
1063 && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) { 1063 && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
1064 if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time 1064 if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time
1065 && time_before(jiffies, timeout_start + audit_backlog_wait_time)) { 1065 && time_before(jiffies, timeout_start + audit_backlog_wait_time)) {
1066 1066
1067 /* Wait for auditd to drain the queue a little */ 1067 /* Wait for auditd to drain the queue a little */
1068 DECLARE_WAITQUEUE(wait, current); 1068 DECLARE_WAITQUEUE(wait, current);
1069 set_current_state(TASK_INTERRUPTIBLE); 1069 set_current_state(TASK_INTERRUPTIBLE);
1070 add_wait_queue(&audit_backlog_wait, &wait); 1070 add_wait_queue(&audit_backlog_wait, &wait);
1071 1071
1072 if (audit_backlog_limit && 1072 if (audit_backlog_limit &&
1073 skb_queue_len(&audit_skb_queue) > audit_backlog_limit) 1073 skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
1074 schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies); 1074 schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies);
1075 1075
1076 __set_current_state(TASK_RUNNING); 1076 __set_current_state(TASK_RUNNING);
1077 remove_wait_queue(&audit_backlog_wait, &wait); 1077 remove_wait_queue(&audit_backlog_wait, &wait);
1078 continue; 1078 continue;
1079 } 1079 }
1080 if (audit_rate_check()) 1080 if (audit_rate_check())
1081 printk(KERN_WARNING 1081 printk(KERN_WARNING
1082 "audit: audit_backlog=%d > " 1082 "audit: audit_backlog=%d > "
1083 "audit_backlog_limit=%d\n", 1083 "audit_backlog_limit=%d\n",
1084 skb_queue_len(&audit_skb_queue), 1084 skb_queue_len(&audit_skb_queue),
1085 audit_backlog_limit); 1085 audit_backlog_limit);
1086 audit_log_lost("backlog limit exceeded"); 1086 audit_log_lost("backlog limit exceeded");
1087 audit_backlog_wait_time = audit_backlog_wait_overflow; 1087 audit_backlog_wait_time = audit_backlog_wait_overflow;
1088 wake_up(&audit_backlog_wait); 1088 wake_up(&audit_backlog_wait);
1089 return NULL; 1089 return NULL;
1090 } 1090 }
1091 1091
1092 ab = audit_buffer_alloc(ctx, gfp_mask, type); 1092 ab = audit_buffer_alloc(ctx, gfp_mask, type);
1093 if (!ab) { 1093 if (!ab) {
1094 audit_log_lost("out of memory in audit_log_start"); 1094 audit_log_lost("out of memory in audit_log_start");
1095 return NULL; 1095 return NULL;
1096 } 1096 }
1097 1097
1098 audit_get_stamp(ab->ctx, &t, &serial); 1098 audit_get_stamp(ab->ctx, &t, &serial);
1099 1099
1100 audit_log_format(ab, "audit(%lu.%03lu:%u): ", 1100 audit_log_format(ab, "audit(%lu.%03lu:%u): ",
1101 t.tv_sec, t.tv_nsec/1000000, serial); 1101 t.tv_sec, t.tv_nsec/1000000, serial);
1102 return ab; 1102 return ab;
1103 } 1103 }
1104 1104
1105 /** 1105 /**
1106 * audit_expand - expand skb in the audit buffer 1106 * audit_expand - expand skb in the audit buffer
1107 * @ab: audit_buffer 1107 * @ab: audit_buffer
1108 * @extra: space to add at tail of the skb 1108 * @extra: space to add at tail of the skb
1109 * 1109 *
1110 * Returns 0 (no space) on failed expansion, or available space if 1110 * Returns 0 (no space) on failed expansion, or available space if
1111 * successful. 1111 * successful.
1112 */ 1112 */
1113 static inline int audit_expand(struct audit_buffer *ab, int extra) 1113 static inline int audit_expand(struct audit_buffer *ab, int extra)
1114 { 1114 {
1115 struct sk_buff *skb = ab->skb; 1115 struct sk_buff *skb = ab->skb;
1116 int ret = pskb_expand_head(skb, skb_headroom(skb), extra, 1116 int ret = pskb_expand_head(skb, skb_headroom(skb), extra,
1117 ab->gfp_mask); 1117 ab->gfp_mask);
1118 if (ret < 0) { 1118 if (ret < 0) {
1119 audit_log_lost("out of memory in audit_expand"); 1119 audit_log_lost("out of memory in audit_expand");
1120 return 0; 1120 return 0;
1121 } 1121 }
1122 return skb_tailroom(skb); 1122 return skb_tailroom(skb);
1123 } 1123 }
1124 1124
1125 /* 1125 /*
1126 * Format an audit message into the audit buffer. If there isn't enough 1126 * Format an audit message into the audit buffer. If there isn't enough
1127 * room in the audit buffer, more room will be allocated and vsnprint 1127 * room in the audit buffer, more room will be allocated and vsnprint
1128 * will be called a second time. Currently, we assume that a printk 1128 * will be called a second time. Currently, we assume that a printk
1129 * can't format message larger than 1024 bytes, so we don't either. 1129 * can't format message larger than 1024 bytes, so we don't either.
1130 */ 1130 */
1131 static void audit_log_vformat(struct audit_buffer *ab, const char *fmt, 1131 static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
1132 va_list args) 1132 va_list args)
1133 { 1133 {
1134 int len, avail; 1134 int len, avail;
1135 struct sk_buff *skb; 1135 struct sk_buff *skb;
1136 va_list args2; 1136 va_list args2;
1137 1137
1138 if (!ab) 1138 if (!ab)
1139 return; 1139 return;
1140 1140
1141 BUG_ON(!ab->skb); 1141 BUG_ON(!ab->skb);
1142 skb = ab->skb; 1142 skb = ab->skb;
1143 avail = skb_tailroom(skb); 1143 avail = skb_tailroom(skb);
1144 if (avail == 0) { 1144 if (avail == 0) {
1145 avail = audit_expand(ab, AUDIT_BUFSIZ); 1145 avail = audit_expand(ab, AUDIT_BUFSIZ);
1146 if (!avail) 1146 if (!avail)
1147 goto out; 1147 goto out;
1148 } 1148 }
1149 va_copy(args2, args); 1149 va_copy(args2, args);
1150 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args); 1150 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args);
1151 if (len >= avail) { 1151 if (len >= avail) {
1152 /* The printk buffer is 1024 bytes long, so if we get 1152 /* The printk buffer is 1024 bytes long, so if we get
1153 * here and AUDIT_BUFSIZ is at least 1024, then we can 1153 * here and AUDIT_BUFSIZ is at least 1024, then we can
1154 * log everything that printk could have logged. */ 1154 * log everything that printk could have logged. */
1155 avail = audit_expand(ab, 1155 avail = audit_expand(ab,
1156 max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail)); 1156 max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
1157 if (!avail) 1157 if (!avail)
1158 goto out; 1158 goto out;
1159 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2); 1159 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
1160 } 1160 }
1161 if (len > 0) 1161 if (len > 0)
1162 skb_put(skb, len); 1162 skb_put(skb, len);
1163 out: 1163 out:
1164 return; 1164 return;
1165 } 1165 }
1166 1166
1167 /** 1167 /**
1168 * audit_log_format - format a message into the audit buffer. 1168 * audit_log_format - format a message into the audit buffer.
1169 * @ab: audit_buffer 1169 * @ab: audit_buffer
1170 * @fmt: format string 1170 * @fmt: format string
1171 * @...: optional parameters matching @fmt string 1171 * @...: optional parameters matching @fmt string
1172 * 1172 *
1173 * All the work is done in audit_log_vformat. 1173 * All the work is done in audit_log_vformat.
1174 */ 1174 */
1175 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...) 1175 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
1176 { 1176 {
1177 va_list args; 1177 va_list args;
1178 1178
1179 if (!ab) 1179 if (!ab)
1180 return; 1180 return;
1181 va_start(args, fmt); 1181 va_start(args, fmt);
1182 audit_log_vformat(ab, fmt, args); 1182 audit_log_vformat(ab, fmt, args);
1183 va_end(args); 1183 va_end(args);
1184 } 1184 }
1185 1185
1186 /** 1186 /**
1187 * audit_log_hex - convert a buffer to hex and append it to the audit skb 1187 * audit_log_hex - convert a buffer to hex and append it to the audit skb
1188 * @ab: the audit_buffer 1188 * @ab: the audit_buffer
1189 * @buf: buffer to convert to hex 1189 * @buf: buffer to convert to hex
1190 * @len: length of @buf to be converted 1190 * @len: length of @buf to be converted
1191 * 1191 *
1192 * No return value; failure to expand is silently ignored. 1192 * No return value; failure to expand is silently ignored.
1193 * 1193 *
1194 * This function will take the passed buf and convert it into a string of 1194 * This function will take the passed buf and convert it into a string of
1195 * ascii hex digits. The new string is placed onto the skb. 1195 * ascii hex digits. The new string is placed onto the skb.
1196 */ 1196 */
1197 void audit_log_hex(struct audit_buffer *ab, const unsigned char *buf, 1197 void audit_log_hex(struct audit_buffer *ab, const unsigned char *buf,
1198 size_t len) 1198 size_t len)
1199 { 1199 {
1200 int i, avail, new_len; 1200 int i, avail, new_len;
1201 unsigned char *ptr; 1201 unsigned char *ptr;
1202 struct sk_buff *skb; 1202 struct sk_buff *skb;
1203 static const unsigned char *hex = "0123456789ABCDEF"; 1203 static const unsigned char *hex = "0123456789ABCDEF";
1204 1204
1205 if (!ab) 1205 if (!ab)
1206 return; 1206 return;
1207 1207
1208 BUG_ON(!ab->skb); 1208 BUG_ON(!ab->skb);
1209 skb = ab->skb; 1209 skb = ab->skb;
1210 avail = skb_tailroom(skb); 1210 avail = skb_tailroom(skb);
1211 new_len = len<<1; 1211 new_len = len<<1;
1212 if (new_len >= avail) { 1212 if (new_len >= avail) {
1213 /* Round the buffer request up to the next multiple */ 1213 /* Round the buffer request up to the next multiple */
1214 new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1); 1214 new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
1215 avail = audit_expand(ab, new_len); 1215 avail = audit_expand(ab, new_len);
1216 if (!avail) 1216 if (!avail)
1217 return; 1217 return;
1218 } 1218 }
1219 1219
1220 ptr = skb_tail_pointer(skb); 1220 ptr = skb_tail_pointer(skb);
1221 for (i=0; i<len; i++) { 1221 for (i=0; i<len; i++) {
1222 *ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */ 1222 *ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */
1223 *ptr++ = hex[buf[i] & 0x0F]; /* Lower nibble */ 1223 *ptr++ = hex[buf[i] & 0x0F]; /* Lower nibble */
1224 } 1224 }
1225 *ptr = 0; 1225 *ptr = 0;
1226 skb_put(skb, len << 1); /* new string is twice the old string */ 1226 skb_put(skb, len << 1); /* new string is twice the old string */
1227 } 1227 }
1228 1228
1229 /* 1229 /*
1230 * Format a string of no more than slen characters into the audit buffer, 1230 * Format a string of no more than slen characters into the audit buffer,
1231 * enclosed in quote marks. 1231 * enclosed in quote marks.
1232 */ 1232 */
1233 static void audit_log_n_string(struct audit_buffer *ab, size_t slen, 1233 static void audit_log_n_string(struct audit_buffer *ab, size_t slen,
1234 const char *string) 1234 const char *string)
1235 { 1235 {
1236 int avail, new_len; 1236 int avail, new_len;
1237 unsigned char *ptr; 1237 unsigned char *ptr;
1238 struct sk_buff *skb; 1238 struct sk_buff *skb;
1239 1239
1240 if (!ab) 1240 if (!ab)
1241 return; 1241 return;
1242 1242
1243 BUG_ON(!ab->skb); 1243 BUG_ON(!ab->skb);
1244 skb = ab->skb; 1244 skb = ab->skb;
1245 avail = skb_tailroom(skb); 1245 avail = skb_tailroom(skb);
1246 new_len = slen + 3; /* enclosing quotes + null terminator */ 1246 new_len = slen + 3; /* enclosing quotes + null terminator */
1247 if (new_len > avail) { 1247 if (new_len > avail) {
1248 avail = audit_expand(ab, new_len); 1248 avail = audit_expand(ab, new_len);
1249 if (!avail) 1249 if (!avail)
1250 return; 1250 return;
1251 } 1251 }
1252 ptr = skb_tail_pointer(skb); 1252 ptr = skb_tail_pointer(skb);
1253 *ptr++ = '"'; 1253 *ptr++ = '"';
1254 memcpy(ptr, string, slen); 1254 memcpy(ptr, string, slen);
1255 ptr += slen; 1255 ptr += slen;
1256 *ptr++ = '"'; 1256 *ptr++ = '"';
1257 *ptr = 0; 1257 *ptr = 0;
1258 skb_put(skb, slen + 2); /* don't include null terminator */ 1258 skb_put(skb, slen + 2); /* don't include null terminator */
1259 } 1259 }
1260 1260
1261 /** 1261 /**
1262 * audit_log_n_untrustedstring - log a string that may contain random characters 1262 * audit_log_n_untrustedstring - log a string that may contain random characters
1263 * @ab: audit_buffer 1263 * @ab: audit_buffer
1264 * @len: lenth of string (not including trailing null) 1264 * @len: lenth of string (not including trailing null)
1265 * @string: string to be logged 1265 * @string: string to be logged
1266 * 1266 *
1267 * This code will escape a string that is passed to it if the string 1267 * This code will escape a string that is passed to it if the string
1268 * contains a control character, unprintable character, double quote mark, 1268 * contains a control character, unprintable character, double quote mark,
1269 * or a space. Unescaped strings will start and end with a double quote mark. 1269 * or a space. Unescaped strings will start and end with a double quote mark.
1270 * Strings that are escaped are printed in hex (2 digits per char). 1270 * Strings that are escaped are printed in hex (2 digits per char).
1271 * 1271 *
1272 * The caller specifies the number of characters in the string to log, which may 1272 * The caller specifies the number of characters in the string to log, which may
1273 * or may not be the entire string. 1273 * or may not be the entire string.
1274 */ 1274 */
1275 const char *audit_log_n_untrustedstring(struct audit_buffer *ab, size_t len, 1275 const char *audit_log_n_untrustedstring(struct audit_buffer *ab, size_t len,
1276 const char *string) 1276 const char *string)
1277 { 1277 {
1278 const unsigned char *p; 1278 const unsigned char *p;
1279 1279
1280 for (p = string; p < (const unsigned char *)string + len && *p; p++) { 1280 for (p = string; p < (const unsigned char *)string + len && *p; p++) {
1281 if (*p == '"' || *p < 0x21 || *p > 0x7f) { 1281 if (*p == '"' || *p < 0x21 || *p > 0x7f) {
1282 audit_log_hex(ab, string, len); 1282 audit_log_hex(ab, string, len);
1283 return string + len + 1; 1283 return string + len + 1;
1284 } 1284 }
1285 } 1285 }
1286 audit_log_n_string(ab, len, string); 1286 audit_log_n_string(ab, len, string);
1287 return p + 1; 1287 return p + 1;
1288 } 1288 }
1289 1289
1290 /** 1290 /**
1291 * audit_log_untrustedstring - log a string that may contain random characters 1291 * audit_log_untrustedstring - log a string that may contain random characters
1292 * @ab: audit_buffer 1292 * @ab: audit_buffer
1293 * @string: string to be logged 1293 * @string: string to be logged
1294 * 1294 *
1295 * Same as audit_log_n_untrustedstring(), except that strlen is used to 1295 * Same as audit_log_n_untrustedstring(), except that strlen is used to
1296 * determine string length. 1296 * determine string length.
1297 */ 1297 */
1298 const char *audit_log_untrustedstring(struct audit_buffer *ab, const char *string) 1298 const char *audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
1299 { 1299 {
1300 return audit_log_n_untrustedstring(ab, strlen(string), string); 1300 return audit_log_n_untrustedstring(ab, strlen(string), string);
1301 } 1301 }
1302 1302
1303 /* This is a helper-function to print the escaped d_path */ 1303 /* This is a helper-function to print the escaped d_path */
1304 void audit_log_d_path(struct audit_buffer *ab, const char *prefix, 1304 void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
1305 struct dentry *dentry, struct vfsmount *vfsmnt) 1305 struct dentry *dentry, struct vfsmount *vfsmnt)
1306 { 1306 {
1307 char *p, *path; 1307 char *p, *path;
1308 1308
1309 if (prefix) 1309 if (prefix)
1310 audit_log_format(ab, " %s", prefix); 1310 audit_log_format(ab, " %s", prefix);
1311 1311
1312 /* We will allow 11 spaces for ' (deleted)' to be appended */ 1312 /* We will allow 11 spaces for ' (deleted)' to be appended */
1313 path = kmalloc(PATH_MAX+11, ab->gfp_mask); 1313 path = kmalloc(PATH_MAX+11, ab->gfp_mask);
1314 if (!path) { 1314 if (!path) {
1315 audit_log_format(ab, "<no memory>"); 1315 audit_log_format(ab, "<no memory>");
1316 return; 1316 return;
1317 } 1317 }
1318 p = d_path(dentry, vfsmnt, path, PATH_MAX+11); 1318 p = d_path(dentry, vfsmnt, path, PATH_MAX+11);
1319 if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */ 1319 if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */
1320 /* FIXME: can we save some information here? */ 1320 /* FIXME: can we save some information here? */
1321 audit_log_format(ab, "<too long>"); 1321 audit_log_format(ab, "<too long>");
1322 } else 1322 } else
1323 audit_log_untrustedstring(ab, p); 1323 audit_log_untrustedstring(ab, p);
1324 kfree(path); 1324 kfree(path);
1325 } 1325 }
1326 1326
1327 /** 1327 /**
1328 * audit_log_end - end one audit record 1328 * audit_log_end - end one audit record
1329 * @ab: the audit_buffer 1329 * @ab: the audit_buffer
1330 * 1330 *
1331 * The netlink_* functions cannot be called inside an irq context, so 1331 * The netlink_* functions cannot be called inside an irq context, so
1332 * the audit buffer is placed on a queue and a tasklet is scheduled to 1332 * the audit buffer is placed on a queue and a tasklet is scheduled to
1333 * remove them from the queue outside the irq context. May be called in 1333 * remove them from the queue outside the irq context. May be called in
1334 * any context. 1334 * any context.
1335 */ 1335 */
1336 void audit_log_end(struct audit_buffer *ab) 1336 void audit_log_end(struct audit_buffer *ab)
1337 { 1337 {
1338 if (!ab) 1338 if (!ab)
1339 return; 1339 return;
1340 if (!audit_rate_check()) { 1340 if (!audit_rate_check()) {
1341 audit_log_lost("rate limit exceeded"); 1341 audit_log_lost("rate limit exceeded");
1342 } else { 1342 } else {
1343 if (audit_pid) { 1343 if (audit_pid) {
1344 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb); 1344 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
1345 nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0); 1345 nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0);
1346 skb_queue_tail(&audit_skb_queue, ab->skb); 1346 skb_queue_tail(&audit_skb_queue, ab->skb);
1347 ab->skb = NULL; 1347 ab->skb = NULL;
1348 wake_up_interruptible(&kauditd_wait); 1348 wake_up_interruptible(&kauditd_wait);
1349 } else { 1349 } else {
1350 printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0)); 1350 printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0));
1351 } 1351 }
1352 } 1352 }
1353 audit_buffer_free(ab); 1353 audit_buffer_free(ab);
1354 } 1354 }
1355 1355
1356 /** 1356 /**
1357 * audit_log - Log an audit record 1357 * audit_log - Log an audit record
1358 * @ctx: audit context 1358 * @ctx: audit context
1359 * @gfp_mask: type of allocation 1359 * @gfp_mask: type of allocation
1360 * @type: audit message type 1360 * @type: audit message type
1361 * @fmt: format string to use 1361 * @fmt: format string to use
1362 * @...: variable parameters matching the format string 1362 * @...: variable parameters matching the format string
1363 * 1363 *
1364 * This is a convenience function that calls audit_log_start, 1364 * This is a convenience function that calls audit_log_start,
1365 * audit_log_vformat, and audit_log_end. It may be called 1365 * audit_log_vformat, and audit_log_end. It may be called
1366 * in any context. 1366 * in any context.
1367 */ 1367 */
1368 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 1368 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
1369 const char *fmt, ...) 1369 const char *fmt, ...)
1370 { 1370 {
1371 struct audit_buffer *ab; 1371 struct audit_buffer *ab;
1372 va_list args; 1372 va_list args;
1373 1373
1374 ab = audit_log_start(ctx, gfp_mask, type); 1374 ab = audit_log_start(ctx, gfp_mask, type);
1375 if (ab) { 1375 if (ab) {
1376 va_start(args, fmt); 1376 va_start(args, fmt);
1377 audit_log_vformat(ab, fmt, args); 1377 audit_log_vformat(ab, fmt, args);
1378 va_end(args); 1378 va_end(args);
1379 audit_log_end(ab); 1379 audit_log_end(ab);
1380 } 1380 }
1381 } 1381 }
1382 1382
1383 EXPORT_SYMBOL(audit_log_start); 1383 EXPORT_SYMBOL(audit_log_start);
1384 EXPORT_SYMBOL(audit_log_end); 1384 EXPORT_SYMBOL(audit_log_end);
1385 EXPORT_SYMBOL(audit_log_format); 1385 EXPORT_SYMBOL(audit_log_format);
1386 EXPORT_SYMBOL(audit_log); 1386 EXPORT_SYMBOL(audit_log);
1387 1387